Repository navigation
KeycloakAuthenticationToken class no roles? #8861
Answered
by
rainbowechoes
rainbowechoes
asked this question in
Q&A
|
I use So I create two users, tom and zhm, two roles, admin and user. Tom has admin role, zhm has user role. My springboot app client is bearer only. Api admin is under admin role, api user is under user role. like this: my maven dependecies is: <dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<group
8000
Id>org.keycloak</groupId>
<artifactId>keycloak-spring-security-adapter</artifactId>
<version>15.0.2</version>
</dependency>
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-spring-boot-starter</artifactId>
<version>15.0.2</version>
</dependency>
.....here is my application config: server.port=9002
keycloak.realm=cloud-cmp
keycloak.bearer-only=true
keycloak.auth-server-url=http://localhost:8180/auth
keycloak.ssl-required=none
keycloak.resource=backend
keycloak.use-resource-role-mappings=true
keycloak.principal-attribute=preferred_username
logging.level.org=debug
here is my keycloak security config: @KeycloakConfiguration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class KeycloakSecurityConfigurer extends KeycloakWebSecurityConfigurerAdapter {
private ApiSecurityConfig apiSecurityConfig;
/**
* 由于是 restful 应用，因此不需要使用到 session 策略
*
* @return
*/
@Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
return new NullAuthenticatedSessionStrategy();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
KeycloakAuthenticationProvider authenticationProvider = keycloakAuthenticationProvider();
authenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper());
auth.authenticationProvider(authenticationProvider);
}
/**
* 配置安全策略
*
* @param http
* @throws Exception
*/
@Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
http.authorizeRequests()
// .antMatchers("/pub").permitAll()
.anyRequest().authenticated()
.and().csrf().disable();
}
@Bean
KeycloakConfigResolver keycloakConfigResolver() {
return new KeycloakSpringBootConfigResolver();
}
@Bean
public FilterRegistrationBean keycloakAuthenticationProcessingFilterRegistrationBean(final KeycloakAuthenticationProcessingFilter filter) {
final FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
registrationBean.setEnabled(false);
return registrationBean;
}
@Bean
public FilterRegistrationBean keycloakPreAuthActionsFilterRegistrationBean(
final KeycloakPreAuthActionsFilter filter) {
final FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
registrationBean.setEnabled(false);
return registrationBean;
}
@Bean
public FilterRegistrationBean keycloakAuthenticatedActionsFilterBean(
KeycloakAuthenticatedActionsFilter filter) {
FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
registrationBean.setEnabled(false);
return registrationBean;
}
@Bean
public FilterRegistrationBean keycloakSecurityContextRequestFilterBean(
KeycloakSecurityContextRequestFilter filter) {
FilterRegistrationBean registrationBean = new FilterRegistrationBean(filter);
registrationBean.setEnabled(false);
return registrationBean;
}
@Bean
@Override
@ConditionalOnMissingBean(HttpSessionManager.class)
protected HttpSessionManager httpSessionManager() {
return new HttpSessionManager();
}
}when I call api with token, no role info in KeycloakAuthenticationToken. Whether I access the admin or user api, the api reports a 403 exception. I think no role info should is the reason. The Authentication is get by SecurityContextHolder in KeycloakAuthenticationProcessingFilter. But I don't know where the Authentication is placed in the SecurityContextHolder after debug. Anyone can help me? |
Answered by
rainbowechoes
Nov 24, 2021
Replies: 1 comment
|
I have resolved it! |
0 replies
Answer selected by
rainbowechoes
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I have resolved it!